Questions tagged [capabilities]
POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.
122
questions
0
votes
1
answer
120
views
After executing setcap, why I still can't use tar and got an error "operation not permitted"?
Question
I'm doing my internship, working on container security and recently I need to build a container which has security problem to do some tests. Here is my dockerfile
FROM dockerfiles/centos-lamp
...
- 103
1
vote
0
answers
31
views
Effects of dropping "AUDIT_WRITE", "KILL", "SETFCAP" and "SETPCAP" capabilities while running docker
I'm exploring Docker container capabilities and permissions and I'm curious about the implications of dropping the "AUDIT_WRITE", "KILL", "SETFCAP" and "SETPCAP"...
0
votes
0
answers
82
views
capabilities in AppArmor profile vs extended attributes
I'm trying understand AppArmor capabilities at the moment. I found an example which had me make a copy of /bin/ping and generate AppArmor profile for it.
First I made a copy of /bin/ping and set it's ...
- 23
0
votes
0
answers
63
views
aws efs and container caps to be able to run `mount nfs` inside the container manually
I'm running a pod inside aws eks 1.26. I need to mount aws efs via kubectl exec operation and fail if the POD is not started with privileged container.
What priviliges are required for the container ...
- 775
2
votes
1
answer
422
views
Allowing a non-root user to create TUN/TAP interfaces
I have a situation where I need a non-root user to be allowed to create TUN/TAP interfaces. I understand that this requires the CAP_NET_ADMIN capability.
There have been other questions about this, ...
- 131
3
votes
1
answer
245
views
docker run cap-drop=net_bind_service still has nginx running on the port 80
docker run --rm --cap-drop=net_bind_service --publish 8080:80 --name nginx nginx
ps --forest -fC nginx
UID PID PPID C STIME TTY TIME CMD
root 449870 449847 0 12:38 ? ...
- 775
1
vote
1
answer
132
views
Is POSIX 1e Capabilities widely implemented?
Do somebody know what are the Operating Systems that implemented capabilities (i.e. Posix 1e)?
are they compatible?
will capabilities reduce portability to Linux only?
- 189
5
votes
1
answer
222
views
What happened to CAPNG_SELECT_AMBIENT?
Three years ago, I wrote a program to manipulate the CAP_NET_RAW capability of my programs. I used the AMBIENT capability set.
But now, I'm not able to compile my program on my actual Debian distro (...
- 189
3
votes
1
answer
236
views
Launch process with limited capabilities on minimal Busybox-based system
In a minimal Busybox-based Linux system with access to the root user, how can one launch a process with a specific limited set of Linux capabilities(7) without requiring any tools beyond busybox?
- 1,913
0
votes
0
answers
30
views
How to allow every admin access except viewing and editing a single directory?
We have some servers running our web application as well as nginx, redis and a few other services. I want to grant access to these servers to a system administrator to manage these systems, but I want ...
- 145
3
votes
1
answer
466
views
How do I enable unprivileged_userns_clone selectively for one executable or user?
How do I enable CLONE_NEWUSER in a more fine-grained fashion compared to just kernel.unprivileged_userns_clone?
I want to keep kernel API attack surface manageable by keeping new and complicated ...
- 5,598
4
votes
1
answer
833
views
What mechanism prevents me from reading /proc/<PID>/environ in containers with a PID namespace shared with the host?
While investigating sharing the PID namespace with containers, I noticed something interesting that I don't understand. When a container shares the PID namespace with the host, some processes have ...
- 131
5
votes
2
answers
202
views
Preventing POSIX capabilities proliferation
Generally speaking, a unix (or specifically Linux) program can't do something like using ICMP_ECHO ("ping") to check the accessibility of a router unless either run by the superuser or ...
1
vote
1
answer
292
views
Reproduce setcap behavior with capsh
There is a non-capability-aware program that requires at least 1) cap_sys_admin and 2) either cap_dac_override or cap_dac_read_search. This can be proven as follows:
sudo setcap 'all=ep cap_sys_admin-...
- 113
1
vote
1
answer
141
views
capsh works but systemd doesn't - Openvpn unprivileged user
OS: Debian 11
Package: OpenVPN 2.5.1
Background:
After an update, Openvpn-2.5 clients can no longer use iproute to
modify the interface and configure routes pushed by the OpenVPN server
after root ...
- 89
1
vote
1
answer
180
views
why a non root user call getenv on an exported variable returns nil
C code here:
#include <stdio.h>
#include <stdlib.h>
int main () {
printf("PATH : %s\n", getenv("PATH"));
printf("HOME : %s\n", getenv("HOME"))...
- 53
1
vote
1
answer
291
views
Can two different sets of capabilities be set to one file?
I'd like to set different capabilities to permitted and inherited sets of my file. Something like this:
sudo setcap cap_fsetid=ei mybinary
sudo setcap cap_kill=ep mybinary
However, the latter command ...
- 57
0
votes
0
answers
923
views
Program cannot acquire the capabilities it needs (raw sockets)
Note: This is partly a programming question, but my gut feeling is that this has more to do with the Linux' security capabilities framework in general, hence posting here instead of StackOverflow.
I ...
- 131
1
vote
0
answers
102
views
How does libpcap read network packets, and why can it not operate in some VMs?
I'm interested to learn how libpcap reads network packets, as I am finding it is not possible when running on AWS Lambda
From what I can understand, you need either or both of the CAP_NET_ADMIN and ...
- 111
0
votes
1
answer
2k
views
How to get list of Linux capabilities
I need to get a list of capabilities available to the version of linux on which the program is executed. Just in order to give user possibility to choose what capability to grant to the file. Is there ...
- 57
2
votes
1
answer
503
views
Are capabilities per-process or per-thread attributes?
Documentation says that capabilities are per-thread attributes. Indeed in any
/proc/[PID]/task/[LWP]/status
we can find capabilities, related to this thread:
CapInh: 0000000000000000
CapPrm: ...
- 57
2
votes
1
answer
308
views
How can an unprivileged file have an enabled effective bit? (POSIX capabilities)
I'm trying to understand POSIX-capabilities principles, their transformation during execve() to be more specific. I'll put some quotes from documentation during my question:
P'(ambient) = (...
- 57
1
vote
0
answers
86
views
Is there any tool or method to debug an error about `open fileXXX: Operation not permitted?`
I have a running program trying to open and write to a file under systemd folder:
/etc/systemd/system/mysqld_3310.service.d/u_iops_value
but got this error:
write /etc/systemd/system/mysqld_3310....
- 53
1
vote
1
answer
186
views
Which actions a non-root process can't do?
Obviously, it can not rwx files that it doesn't have permission to. But I am talking about other "actions", I know of them is binding to ports with lower number than 1024. What else ?
- 171
0
votes
1
answer
286
views
Not able to assign root privilege to my process again by using setuid(0) in the same boot cycle
I have added the capability by using following cmd on terminal (alternative of setting CAP_SETUID in drop-in file). Verified that setuid/seteuid is working.
setcap cap_sys_admin,cap_setuid+ep /...
0
votes
1
answer
834
views
getpcaps not working in ubuntu 20.04 with linux 5.11.0-38-generic
I saw on StackOverflow https://stackoverflow.com/a/64000118/8507296 to check capabilities of the process using command
getpcaps <pid>
Output of ps command
$ ps
PID TTY TIME CMD
...
- 101
6
votes
2
answers
578
views
Granting Capabilities to a user through PAM doesn't apply to SSH
I am using CentOS 8, and I would like to grant a user the cap_dac_read_search capability though PAM. It seems to work through local login and su, but not through ssh.
I followed these steps, and only ...
- 73
3
votes
1
answer
3k
views
What is the relation between CAP_NET_RAW and net.ipv4.ping_group_range?
I am using rootless containers, according to the buildah docs,
Moreover, pinging from a rootless container does not work because it lacks the CAP_NET_RAW security capability that the ping command ...
- 29.6k
2
votes
3
answers
222
views
Unable to use the `==` argument of `capsh` to re-exec it?
I am experimenting with capsh of libcap2-bin (1:2.32-1), but have found that I'm unable to use the == argument to re-exec capsh.
In particular, when I'm using the capsh's == argument, it's complaining ...
- 4,203
2
votes
1
answer
401
views
Why is CAP_CHROOT equivalent to root?
I have trouble understanding the root-equivalence of CAP_CHROOT given the below template.
I understand that 1) means to create a directory structure, containing all dependencies (e.g. shared objects), ...
- 4,203
0
votes
1
answer
1k
views
How to read /proc/PID/maps without sudo? [duplicate]
I want to read the memory map (/proc/PID/maps) of some process without being sudo.
And that is trivial, unless, the process has capabilities. See what I mean:
If I run:
$ bash
$ cat /proc/$$/maps
...
0
votes
1
answer
484
views
Do cap_setfcap capability can be used to grant full capabilities to an exe file?
I have a file (let's call it prog) that has the cap_setfcap capabiility.
Can I use it to grant prog (the file itself) full capabilities?
I know it's not recommended, I just want to know if it can be ...
- 1
5
votes
1
answer
6k
views
Why ping works without capability and setuid [duplicate]
I learned from here that there's 2 ways to control privileged activities: setuid and capability.
But when I'm playing around with ping on my machine, it seems that it can bypass these 2 mechanism.
...
- 175
1
vote
1
answer
509
views
Linux Security Best practice: CAP_SETFCAP vs sudoer file
I am new to linux securities and tried to understand what's the best practice for linux capabilities. Here is my scenario:
I have an executable file (let's call it foo) which needs to grant ...
- 19
4
votes
1
answer
452
views
How can a process hold a capability in another namespace?
I'm brooding over the interactions between namespaces and
capabilities. Occasionally, I stumble over wording like the following
from user_namespaces(7):
Holding CAP_SYS_ADMIN within the user ...
- 1,091
2
votes
1
answer
3k
views
Should I grant sudo to a user or add CAP_SYS_ADMIN capabilities to use nvprof/ncu? And why?
Since CUDA 10.1, users are required to have sudo privileges to collect advanced metrics with cuda profiling tools such as nvprof or nsight compute (ncu).
Alternatives to get around it are described ...
- 183
2
votes
1
answer
2k
views
Linux capabilities for modifying files owned by root?
Is there any linux capability to enable normal users to write into root owned files like /etc/resolv.conf and /etc/fstab`?
- 123
20
votes
2
answers
4k
views
How does ping work on Fedora without setuid and capabilities?
As far as I know, ping needs to create a raw socket (which needs either root access or cap_net_raw capabilities).
From my understanding the trend these last years has been to remove setuid binaries ...
- 329
3
votes
2
answers
710
views
Does the root user bypass capability checking?
Does the root user bypass capability checking in the kernel, or is the root user subject to capability checking starting with Linux 2.2?
May applications check for and deny access for the root user, ...
- 4,203
1
vote
1
answer
375
views
linux capabilities to read environment variables?
I'd like to run a service as a non-privileged user, but it needs to bind to a system port number (i.e. less than 1024), so I give it setcap 'cap_net_bind_service=+ep' <path for service>, all ...
- 31
19
votes
1
answer
15k
views
What is the difference between AmbientCapabilities and CapabilityBoundingSet?
I am trying to create a systemd service for a web server process that has to bind to port 80 and 443. I found some examples setting AmbientCapabilities=CAP_NET_BIND_SERVICE and setting both ...
3
votes
2
answers
1k
views
Capability inheritable for system() call in C/C++
Currently I'm trying to understand capabilities in Linux by reading http://man7.org/linux/man-pages/man7/capabilities.7.html
I created a small C++ application with the capability CAP_DAC_READ_SEARCH+...
- 63
0
votes
1
answer
173
views
Does "Polkit" make use of linux capabilities?
I know that some authentication programs like KDE's KAuth can use polkit as the backend.And what makes polkit special is that it can grant some specific privileges to a non-privileged process.A ...
- 1,070
0
votes
2
answers
2k
views
What does capsh --print actually do?
I understand that Linux capabilities are defined on processes/files. But when I do capsh --print, it tells me the capabilities of the user.
So what exactly is capsh --print doing? Capabilities are ...
- 101
1
vote
1
answer
2k
views
Run openvpn as non-root user
I'm trying to run openvpn server within podman unprivileged container.
Openvpn needs to be able to manage network interfaces (i.e. create tun interface, assign IP address to it, bring it up). On my ...
- 121
0
votes
1
answer
308
views
Setting file capabilities in deb package fails
So, there is my piece of software, that has to be distributed via deb-packages, it contains a small custom server. That server requires ability to listen on a priviledged port, because explaining to a ...
- 101
0
votes
0
answers
326
views
How to setcap wifi-menu on arch for non-root users?
I'm trying to run wifi-menu on arch as non-root. No setcap i've tried works.
[root@lilegg johny]# setcap CAP_NET_ADMIN,CAP_SYS_ADMIN,CAP_NET_RAW,CAP_DAC_OVERRIDE=eip /usr/bin/wifi-menu
[root@lilegg ...
- 361
4
votes
0
answers
333
views
Is there something like 'sudo' but give only one capability not real root?
I want to run a one-time web server on port 80, which I will never run again.
Is there something like 'sudo' that gives only temporary CAP_NET_BIND_SERVICE, not real root, to a process? So that we ...
- 449
0
votes
1
answer
146
views
Are there some Unix or Unix-like operating systems that still treats the "root" user as the superuser?
Linux does not treat the "root" user as the superuser anymore, but rather Linux uses capabilities which gives a process privileges (I think BSD does a similar thing).
So for example in older Linux ...
- 1,303
4
votes
1
answer
260
views
Why is there no "set effective supplementary GIDs" syscall?
The "effecive user/group ID" of a process is what the OS uses to determine whether an action (such as opening a file) is permitted by the process. You can set the effective primary GID of the current ...
- 43